Documentation

Last reviewed: May 2026

Data Destruction & Retention

This page explains how Widgi AI deletes data at the end of its life: how long we keep different types of data, how it is automatically destroyed when that period ends, and how it is rendered permanently unrecoverable. It is the public summary of our internal data-destruction control.

In short

Data is deleted automatically when its retention period ends — across live records, backups, logs and search indexes. Our immutable audit archive uses a customer-managed key we control, so destroying that key renders the archive permanently unrecoverable. Other stores are rendered irrecoverable through AWS's certified media-sanitisation and key-lifecycle process, and customer-managed keys are being extended to them next.

1. Cryptographic destruction

“Cryptographic destruction” (also called crypto-shredding) means encrypting data with a key and then destroying the key — so the data can never be read again, no matter what happens to the physical disks.

  • Audit archive (live today) — our tamper-evident audit archive is encrypted with a customer-managed key that we own and control. We can trigger a single action that, after a mandatory safety window, permanently destroys the key and renders the entire archive unrecoverable. The key rotates automatically each year and, in production, is protected so it can never be destroyed by accident.
  • Other stores (today) — these use AWS-managed encryption (AES-256) and are rendered irrecoverable as described below. Extending our own customer-managed keys to these stores is the next planned step, tested in a non-production environment first so the live service is never put at risk.

2. What happens when retention ends

Data is deleted automatically when its retention period ends — through built-in expiry, not manual housekeeping:

  • AI prompts & responses — 180 days (rolling)
  • Audit logs — 3 years (rolling)
  • Account erasure request (DSAR) — within 30 days
  • Organisation content after contract — contract end + 90 days
  • Backups — 35 days (continuous) / 90 days (long-term)
  • Search index & system logs — 90 days / 3 years

Once data is deleted:

  • Logical deletion removes the encrypted data from the live store immediately.
  • The audit archive can be crypto-shredded — destroying its key makes its contents permanently unreadable.
  • For the AWS-managed stores, decommissioned storage media is sanitised by AWS to the recognised NIST 800-88 standard, and keys are rotated and retired on AWS's schedule.
  • Every deletion we control writes an audit record (kept 3 years), so it can always be evidenced when data was deleted — even after the data itself is gone.

The bottom line

Data is deleted automatically at the end of its retention period and rendered irrecoverable — by customer-managed-key cryptographic deletion for the immutable audit archive, and by certified NIST 800-88 media sanitisation plus AWS key-lifecycle for the remaining stores. Every controlled deletion is evidenced by a 3-year audit record.